portugalfuturista/openwrt-pf
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

mtd mtdsplit-fit: fix potential out of bounds read

Browse source 
Account the offset_start in the bounds check of the for loop. This was
previously missing, differing in check and actual read.

Signed-off-by: David Bauer <mail@david-bauer.net>
This commit is contained in:
David Bauer 2026-07-23 01:03:07 +02:00
parent f8386008c0
commit f937146fa1
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_fit.c
View file

@ -218,7 +218,7 @@ mtdsplit_fit_parse(struct mtd_info *mtd,
hdr_len = sizeof(struct fdt_header);
/* Parse the MTD device & search for the FIT image location */
for(offset = 0; offset + hdr_len <= mtd->size; offset += mtd->erasesize) {
for (offset = 0; offset + offset_start + hdr_len <= mtd->size; offset += mtd->erasesize) {
ret = mtd_read(mtd, offset + offset_start, hdr_len, &retlen, (void*) &hdr);
if (ret) {
pr_err("read error in \"%s\" at offset 0x%llx\n",